It is often said "If you cannot measure it, you cannot improve it and You cannot manage what you cannot measure.

Give one example which justify these and another example to refute them.

In order to refute it, simply provide a situation where you can show how it is not easy to quantify some measure.

For example, the number of attacks that were thwarted by the security software may not necessarily indicate its effectiveness since we do not know how many attacks were successful. If a system is never attacked, then there would be zero reported thwarts. This does not necessarily mean that the security software is ineffective.